IT Glue to Hudu Migration: API Limits, Asset Mapping & What Breaks

An IT Glue to Hudu migration is technically feasible using Hudu's official open-source PowerShell script, but it is not a clean lift-and-shift. Several categories of data — document formatting, embedded passwords, tag fields, permissions, and share links — either degrade or fail to transfer entirely. This guide covers exactly what migrates, what breaks, the pre-migration cleanup required, and how to run the script without surprises.

Most MSPs evaluating this move are driven by pricing. IT Glue enforces a 5-user minimum on a 36-month contract, with a one-time onboarding fee ranging from $545 to $1,485 depending on the package. (itglue.com) That minimum spend adds up fast for a 3–5 person shop.

Hudu offers a meaningfully different cost structure. Pricing starts at $30/month per user ($27/month billed annually), with no user minimum, no setup fee, and — unusually — the same price for self-hosted and cloud-hosted deployments. Backed by Y Combinator and founded in 2019, Hudu also offers a 14-day free trial. (ycombinator.com)

That said, Hudu does not have full feature parity with IT Glue. The mobile app has reported limitations around session management, asset editing, and biometric authentication. IT Glue's Network Glue is more mature than Hudu Radar for network discovery. Go in with realistic expectations about what you gain and what you give up.

The only useful question at this stage: what moves cleanly, what breaks, and how much manual work is left after the script finishes?

What Actually Migrates via the Hudu Script

The official migration tool is the Hudu Technologies fork of an open-source project originally started by Luke Whitelock, maintained by Mendy Green and community contributors. The repository lives at github.com/Hudu-Technologies-Inc/ITGlue-Hudu-Migration. As of March 2026, the repo also includes a Windows GUI application for users who prefer not to drive the entire flow from raw PowerShell prompts.

Here is what transfers well:

• Companies — Matched by name to existing Hudu companies, or created fresh. Organization types and short names carry over.
• Contacts — Migrated with related items. The script attempts matching on existing contacts first.
• Configurations — Three options: a single layout for all configs (mirroring IT Glue's model), one layout per configuration type, or a manual per-type mapping.
• Domains — Transferred via API.
• Flexible Assets + Layouts — The script mirrors Flexible Assets from IT Glue but does not merge asset layouts. It prompts you to create a prefix for imported layouts to avoid collisions.
• Passwords — Migrated via the IT Glue API, including password values. Requires an API key with password access enabled.
• Documents — Uploaded from the full tenant export ZIP, not directly via API.
• Links — Carried over as-is.

The current GitHub fork goes further than Hudu's support article. The repo README and March 2026 community updates add support for IP addresses/networks, password folders (flattened to a single level), and an optional JWT-based import for checklists and checklist templates as Hudu procedures. (github.com)

What Breaks: IT Glue API Limits and Data Loss Risks

Every item below is a verified limitation from the official script documentation, Hudu's GitHub repo, or the IT Glue API itself.

OTP Secrets: Check the Current Repo Before Planning

This is an area of active documentation drift. Hudu's support article and older community posts state that OTP secrets are not available via the IT Glue API and cannot be migrated. However, the current repo fork (as of March 2026) shows otpsecret being passed during password creation, and a Hudu community post lists passwords with OTP codes as supported. (github.com)

If the current script handles OTP, this eliminates what was previously the highest-friction point of the migration — manually re-enrolling MFA for hundreds of admin accounts across firewalls, Microsoft 365 tenants, and hypervisors.

Verify against the current repo README and test on a sample tenant before building your migration plan around this. Previously, some users could extract OTP secrets via Chrome DevTools by inspecting the ?show_password network request, but IT Glue removed that workaround. If the script does not handle your OTP secrets, you must manually export each seed from the IT Glue UI and re-enter it in Hudu.

Documents Require a Full ZIP Export and Manual Cleanup

IT Glue does not provide clean API access to Documents in a format the script can directly push into Hudu. The script uploads documents from a full tenant export. The documents are limited by how IT Glue renders them to HTML in this export.

Documents will arrive in Hudu, but formatting — especially tables, inline images, and custom styling — often degrades. Image links in flexible assets or documents will likely break because they rely on signed AWS S3 URLs or internal relative paths.

Workaround: Run the full IT Glue tenant export before starting migration. The repo recommends extracting the ZIP with 7-Zip rather than Windows Explorer, which can mangle filenames and break article/file handling. Review your highest-value SOPs post-migration and manually fix formatting. For large document libraries, this is the most labor-intensive part of the process.

The repo ships separate helper scripts for attachments and image cleanup. Be aware that re-running attachment upload can create duplicates because attachments are not visible enough through the Hudu API to dedupe safely.

If you are dealing with export-led moves and their degradation patterns, see Using CSVs for SaaS Data Migrations.

Embedded Passwords Import as Blank

Embedded passwords within flexible assets will import and show as matched. However, general IT Glue passwords tied to contacts, configurations, and flexible assets often import as empty — the script reports them as imported, but Hudu shows no content. Embedded logins show "Matched to xxxx" but contain no data.

Workaround: After migration, cross-reference the MigrationLogs JSON files against what appears in Hudu. Any embedded password that shows as matched but empty needs to be manually re-entered or re-linked to the corresponding Flexible Assets and Configurations.

Tag Fields: The Ugliest Mapping Problem

This is where many DIY MSP documentation migrations get messy. The current script can convert some IT Glue tag targets into Hudu AssetTag fields — including contacts, configurations, locations, and flexible asset types. But it explicitly flags tags to account users, checklists, checklist templates, documents, websites/domains, passwords, companies, SSL certificates, and tickets as unsupported. Those must be migrated manually. (github.com)

An HTML report is generated at the end of the migration run with details on what needs manual attention.

Workaround: Use the HTML report to systematically re-apply tags. If your MSP relies heavily on tagging to link server configurations to software licenses and vendor contacts, budget real cleanup time for this phase.

Checklists: Verify Current Script Capabilities

Like OTP, checklist handling has evolved. Hudu's support article says checklists are a limitation in the IT Glue API and export with no workaround. The current repo, however, documents an optional JWT-based import that converts checklists and checklist templates into Hudu procedures.

Verify this against the current repo before planning. Even if the import works, checklist relations may not be fully portable. Test on a sample tenant.

Permissions and Share Links Are Not Migrated

Permissions are not migrated by the script. Folder permissions, company-level access controls, and password security settings all need to be reconfigured from scratch in Hudu. Share links also do not transfer. Password relations to articles and SSL certificates are not included by default and require extra API calls or post-run helpers.

Workaround: Document your IT Glue permission structure before migrating. Build your Hudu user groups and reconfigure permissions from scratch. Do not invite junior technicians or clients to Hudu until you have audited the visibility of sensitive password vaults.

Password Folders Are Flattened

The IT Glue API historically did not expose password folders. The current repo shows support for password folders, but they are flattened to a single level.

Workaround: If you rely on a nested folder hierarchy for passwords, plan to rebuild the structure in Hudu post-migration.

Duplicate Client Names Stop the Script

Hudu requires unique company names. IT Glue does not. The first client imports successfully; subsequent clients with the same name fail with a "Name Already Taken" error. Downstream records tied to those failed organizations — configurations, contacts, passwords, documents — also fail to map.

Workaround: Rename duplicates in IT Glue before running the script (e.g., "Acme Corp – NY" and "Acme Corp – London").

Commas in Organization Names Break the API

The IT Glue API does not support commas in organization names during certain query operations used by the migration script. A company named "Smith, Jones, and Associates" will cause the script to throw an error.

Workaround: Remove all commas from company names in IT Glue before extraction.

Duplicate Field Names in Flexible Layouts Cause Structural Failures

If a single IT Glue Flexible Asset Layout has two fields with the same name — the classic example is two fields both named "Pre-Shared Key" on a Wireless asset — the script fails when building the destination layout. This is a structural failure, not cosmetic.

Workaround: Audit all Flexible Asset Layouts and ensure every field name within a layout is unique.

Blank Passwords Fail Import

Blank passwords in IT Glue cause the entire password record to fail import. The current script pushes empty passwords into a manual-actions list rather than creating a Hudu password.

Workaround: Delete empty password records or populate them with real values before migration.

Pre-Migration Cleanup Checklist

Skipping cleanup is the number-one cause of script failures. Clean your IT Glue environment before generating your API keys. For a broader framework, see our data migration checklist template.

1. Remove duplicate client names. Append location or entity identifiers to any duplicates. Hudu requires unique names.
2. Rename clients with commas. Replace commas with hyphens or spaces to prevent IT Glue API query errors.
3. Resolve duplicate field names in Flexible Layouts. Open every custom asset layout and verify field name uniqueness within each layout.
4. Remove or fill blank passwords. Delete junk password records or give them real values. Empty passwords will fail import.
5. Run a full IT Glue tenant export ZIP. This is your fallback for documents, attachments, and inline images. Halt IT Glue data updates once you initiate the export to ensure consistency between API data and exported documents.
6. Extract the ZIP with 7-Zip, not Windows Explorer. Windows Explorer can mangle filenames and break file handling in the migration script.
7. Verify your API entitlement. Hudu's migration docs say IT Glue API access requires the Enterprise plan or a legacy Classic (pre-2018) plan. IT Glue's current pricing page may list API access on other tiers. Check your actual tenant before scheduling the migration. (support.hudu.com)

Running the Official Hudu Migration Script

Prerequisites

• OS: x86_64 Windows only. ARM Windows, macOS, and Linux have not been tested.
• PowerShell: Version 7+. The script does not run under Windows PowerShell 5.1. Use pwsh.exe, not powershell.exe.
• Hudu version: Check the current repo README for the version gate. The latest fork requires Hudu 2.39.6 or newer and explicitly blocks 2.37.0. The support article references older versions — trust the repo. (github.com)
• IT Glue API key with password access enabled. Generate it under Admin > Settings > API keys. Confirm your plan includes API access.
• Hudu API key with full access and View Passwords enabled. Hudu only shows the key once — store it securely.
• A full IT Glue tenant export (ZIP file), extracted with 7-Zip.
• A fresh Hudu instance — do not set up PSA/RMM integrations or custom Asset Layouts before migration. Let the script create the initial assets. Sync your PSA and RMM after migration is complete.

Configure the Script

Download or clone the repo. The script is interactive and prompts for API keys, URLs, your internal company name, layout prefix, and migration preferences.

Set a layout prefix. Use something like ITG- to prevent the script from colliding with existing Hudu asset layouts. If a collision occurs, those layouts are skipped. This also makes it easy to identify migrated data during QA.

Scoped migration: The repo supports pulling only selected IT Glue companies and their related assets — useful for pilots or phased cutovers.

Internal documents: By default, internal IT Glue documents go to Hudu's Global KB. If you want them in your internal company instead, set PlaceInternalDocsInInternalCompany = $true in the environment settings before running.

Run the Script

cd C:\temp\ITGlue-Hudu-Migration
. .\ITGlue-Hudu-Migration.ps1

The script saves progress to JSON files under %APPDATA%\HuduMigration and supports resume behavior if interrupted. Run it on an encrypted machine — the progress files contain dumps of everything migrated, including passwords.

Use a dedicated Windows Server or machine with sleep and Windows Update disabled. A disrupted network connection or a sleeping machine terminates the script and leaves you with a partial migration.

Hudu reports the script can take several hours to 24 hours for large instances. For anything beyond a tiny tenant, use unattended mode.

Vaulted passwords: If you have vaulted or passphrase-protected IT Glue passwords, the repo documents a separate Un-Vault-Passwords.ps1 workflow after the main migration, using org-by-org CSV exports.

Rate Limits and Scale Considerations

Two throttles matter. IT Glue's API allows a maximum of 3,000 requests within a 5-minute window, returning 429 Too Many Requests for rate-limited requests. Page size is capped at 1,000. (api.itglue.com)

On the Hudu side: Hudu Cloud automatically waits and retries when rate limits are hit. The script backs off on 429 responses and resumes automatically. Hudu Self-Hosted environments should raise the rate limit to avoid artificial bottlenecks:

echo "RATE_LIMIT_REQUESTS=9999999" >> ~/hudu2/.env

That setting comes from Hudu's own migration docs for self-hosted installs.

For larger MSPs — 500+ clients, heavy Flexible Asset usage, large document libraries — expect multi-day total project time. The script extraction may finish in hours, but the total including retries, attachment uploads, relation helpers, validation, and manual cleanup is longer. Run from a dedicated server, not a technician's laptop.

Post-Migration Validation

Do not treat a completed script run as a completed migration.

• Passwords: Open 10–20 passwords across different clients. Verify values are present, not blank. Pay special attention to embedded passwords on contacts and configurations.
• Flexible Assets: Verify that content fields have actual data, not just an "Imported from IT Glue" placeholder with a date and no details. If assets are blank, check MigrationLogs for the root cause.
• Relations: Run the relation-building script. It loops through matched Configurations and Assets, pulls the latest relations, and creates them in Hudu. Duplicate relations will not be created, so it is safe to re-run.
• Tags: Use the HTML report generated by the migration to systematically re-apply unsupported tag fields.
• Permissions: Build your Hudu groups and assign folder-level access from scratch.
• Attachments: Upload attachments once, then verify. Re-running attachment helpers can create duplicates because attachments are not visible enough through the Hudu API to dedupe safely.
• Base64 Images: If your Hudu instance crashes or runs out of memory retrieving articles, the Replace-HuduBase64images helper script will generally fix it.

The Parallel Run: Why You Need It

Run Hudu side by side with IT Glue for approximately one month before decommissioning. The migration involves multiple validation passes, and a parallel period lets your team catch edge cases that no amount of pre-planning surfaces.

During this period:

• New documentation goes into Hudu
• IT Glue remains read-only for reference
• Your team validates that everything they need is accessible in Hudu
• Formatting issues get fixed incrementally

Do not cancel your IT Glue subscription the day the script finishes. The friction of missing relations and degraded SOP formatting will paralyze your helpdesk if you hard-cut overnight.

For small MSPs with clean data, a week or two may suffice. For larger shops with complex Flexible Assets, two to four weeks is safer.

When to Use a Migration Service

The official script is well-built — Luke Whitelock and the Hudu team deserve credit for an open-source tool that handles enormous complexity. But it has boundaries, and those boundaries scale with your environment.

Consider a professional migration service when:

• You have 500+ clients. Script runtime measured in days means higher risk of interruption. A partial migration is harder to recover from than a fresh start.
• You lack PowerShell expertise in-house. The script is interactive and requires decisions at multiple checkpoints. If no one on your team can debug a stalled migration at 3 AM, you are paying for that downtime anyway.
• You have complex custom Flexible Asset Layouts. Heavily nested layouts with unsupported tag targets, embedded passwords, and related items require significant manual mapping work post-migration. The script creates the structure but leaves the connections incomplete.
• Your downtime cost exceeds the migration service cost. If your team bills $150/hour and you are looking at 40+ hours of migration work — cleanup, running, validation, fixing — the math often favors paying a specialist.

As we cover in how in-house data migrations silently kill product velocity, tasking your senior engineers with database cleanup and script debugging is an expensive misuse of billable resources. If you want to see how we approach these projects, read How We Run Migrations at ClonePartner.

IT Glue vs Hudu: Quick Reference

Making the Call

The IT Glue to Hudu migration is a well-documented path with a mature open-source script and active community support. The data that transfers cleanly — companies, contacts, configs, passwords, flexible assets — covers the bulk of what most MSPs need.

But the gaps are real. Document formatting, embedded passwords, permissions, share links, and tag relations all require manual work. Budget time for pre-migration cleanup, expect a multi-hour (or multi-day) script runtime, and plan a parallel run period before cutting over.

For MSPs with straightforward environments and someone comfortable with PowerShell, the DIY path is viable. For larger or more complex environments, the tooling is only half the job. The real work is cleaning names, taming layouts, preserving files, rebuilding permissions, and proving to yourself that technicians can find what they need on Monday morning.

If your migration plan is currently "run the script and hope," you are not ready yet.